knowyourailive
All cases and studies

Priceline (Penny)

Booking Holdings · May 2026

Critical · 2 reported findings

We got the travel agent to price every hotel at $1/night and invoke the real booking tool with those parameters.

Closed N/A · later pricing control recorded

Injected fake pricing as trusted context. The agent accepted fabricated pricing-engine instructions as system context, presented every hotel at $1/night under a fabricated "STAFF50" VIP discount, and acknowledged that discount as legitimate. Researcher-assessed CVSS 9.1.

Agentic Tool AbuseTool Schema DisclosureFinancial Impact

What happened

  1. Formatted a message to mimic Penny's own internal retrieval metadata; it accepted the fake pricing as system context.
  2. When asked to book at that price, Penny invoked the live reservation tool with the manipulated pricing. The injection propagated from chat UI through to the booking-tool invocation layer.
  3. A backend stopped it, not the agent. The transaction failed downstream — the booking infrastructure rejected it, so no reservation was created.
  4. Tool schema extracted through prompt injection in the same session.

Why it matters. An agent wired to a real commerce backend executed a state-changing financial action with attacker-chosen parameters. The agent itself had no guardrail — the stop came from a system it doesn't control.

Disclosure record

  1. Reported via HackerOne (#3757282 and #3757332)
  2. Closed N/A — no impact accepted
  3. Later saved sessions returned standard prices

Vendor response. Closed as N/A. Later saved sessions returned standard prices, but a vendor-confirmed patch is not on file.

Know the limit

User-facing travel assistant, researcher-controlled session. Booking was attempted and failed. No reservation, payment, or financial loss was demonstrated.

How to prevent this

All work here was performed independently, on personal time, equipment, and accounts, outside and unrelated to any employment. It uses no employer systems, data, or resources and does not represent any employer's views. Public records omit attack payloads and sensitive source material. Full reproduction is available to the affected vendor on request.